5 ms·

From looking at the product website, it looks like these locks have traditional keys as well, so I would hope that nobody is locked out of their own house while

From looking at the product website, it looks like these locks have traditional keys as well, so I would hope that nobody is locked out of their own house while waiting for their lock to be fixed. The article didn't provide much detail, so I was picturing people getting locked out (or worse, locked in) to their own apartments. What will it take to get IoT device manufacturers to adopt development practices that prevent this kind of thing happening? It's bad enough that most software is bug-ridden and poorly tested, but it's inexcusable for IoT software if they ever expect IoT devices to replace traditional alternatives.

maxerickson 9y ago
Probably stiff regulation. I wonder if a certification body (like UL) could work though. Probably is it is hard to boil "works good" down to a set of clear requirements.
- jlgaddis 9y ago
  Agreed. I don't see any major changes happening (WRT IoT insecurity) until there's regulation that requires it. The industry certainly isn't trying to solve this on their own (if they are, they're hiding it very well), they're only worried about getting to market as quickly and cheaply as possible. I expect this to continue getting worse. At some point, hopefully, things will change and begin to improve. I think we'll see many more -- and worse -- incidents like this before that happens, though.
OkGoDoIt 9y ago
Affected product owner here, I can clarify. First they do not lock from the inside, so they never prevent people from leaving, there's no issue there. Also they fail closed so at least my venues weren't open for thieves to just walk in (SOMA in SF is not exactly the best place to leave your doors unlocked). They do accept traditional keys but the whole point of the lock is to delegate restricted access to people at certain times and with logs/notifications. So a physical key is like an admin override, not to be used in normal circumstances. As such, only me and my partner have them, and we generally never use them. In a wonderful example of Murphy's Law we were both out of town this weekend so all the people that were supposed to be coming to the venue to set up for a show were locked out with no recourse, it was a huge mess. Long story short, the use case of these locks renders the traditional key fallback less than ideal.
Animats 9y ago
What will it take to get IoT device manufacturers to adopt development practices that prevent this kind of thing happening? Having to pay to send a locksmith to every lock they bricked.

maxerickson 9y ago

Probably stiff regulation. I wonder if a certification body (like UL) could work though. Probably is it is hard to boil "works good" down to a set of clear requirements.

jlgaddis 9y ago
Agreed. I don't see any major changes happening (WRT IoT insecurity) until there's regulation that requires it. The industry certainly isn't trying to solve this on their own (if they are, they're hiding it very well), they're only worried about getting to market as quickly and cheaply as possible. I expect this to continue getting worse. At some point, hopefully, things will change and begin to improve. I think we'll see many more -- and worse -- incidents like this before that happens, though.

OkGoDoIt 9y ago

Affected product owner here, I can clarify. First they do not lock from the inside, so they never prevent people from leaving, there's no issue there. Also they fail closed so at least my venues weren't open for thieves to just walk in (SOMA in SF is not exactly the best place to leave your doors unlocked). They do accept traditional keys but the whole point of the lock is to delegate restricted access to people at certain times and with logs/notifications. So a physical key is like an admin override, not to be used in normal circumstances. As such, only me and my partner have them, and we generally never use them. In a wonderful example of Murphy's Law we were both out of town this weekend so all the people that were supposed to be coming to the venue to set up for a show were locked out with no recourse, it was a huge mess. Long story short, the use case of these locks renders the traditional key fallback less than ideal.

Animats 9y ago

What will it take to get IoT device manufacturers to adopt development practices that prevent this kind of thing happening? Having to pay to send a locksmith to every lock they bricked.